Ironflow is pre-1.0: APIs can change between releases. Pin a version. What is ready →

SDK Parity Matrix

This is the canonical Ironflow capability catalog and the exhaustive companion to the SDK Comparison page. Its schema and exposure boundaries are recorded in ADR 0065 after the implementation-evidence audit of 2026-08-26. Where the comparison page answers “which SDK should I use”, this matrix answers “exactly how is this capability exposed, and how sure are we”.

Statuses: full (verified end to end), partial (works with a documented limit), indirect (delivered through a different mechanism than the named endpoint), missing (implemented on the server, no exposure here), intentionally-excluded (a deliberate product or trust boundary), not-applicable, unverified (support could not be proved from source — treat as unknown, not as ❌). Tests/Docs record the audited state per capability, and Classification names the dominant gap class for the row (none means no gap).

Readiness rates the capability itself: Ready, Evolving or Experimental. Ironflow is pre-1.0, so “Ready” means ready within a pre-1.0 product. See Readiness for the meanings.

Each table is wider than the page. Scroll it sideways to see all columns. A glow at the right edge shows that more columns are hidden.

Deployment-dependent exposure

The ironflow serve command wires NATS, PubSub, the NATS-backed secrets manager, and an engine with a worker manager. Embedded servers can omit those dependencies, which changes the routes that are actually mounted:

Surface	Required dependency	Behavior when dependency is absent
PubSubService (ConnectRPC)	PubSub bridge and consumer manager	Service is not mounted.
Pub/sub subscriptions (WebSocket)	PubSub manager	Upgrade succeeds; subscribe requests return `PubSub not configured`.
KV and config (REST and WebSocket watch)	NATS provider	Routes are not mounted.
Secrets (REST)	Secrets manager	Routes are not mounted. The standard CLI manager is NATS-backed.
WorkerService (ConnectRPC)	Engine with a worker manager	Service is not mounted.
Pull-worker polling (REST)	REST worker handler	Routes are not mounted.

The REST route manifest is the immutable SDK-generation catalog, so it still lists optional REST routes that an embedded instance did not mount. The ConnectRPC portion is built from that instance’s mounted-service snapshot.

Streaming, WebSocket, and push exposure

Nine capability rows cover server push and live delivery. This is a capability inventory, not a count of wire endpoints: Pub/sub subscription has both a ConnectRPC stream and the generic WebSocket transport.

Capability ID	Server transport
`exec-push-serve`	Engine HTTP POST to the SDK-owned `serve()` endpoint
`exec-streaming-worker`	`WorkerService/Connect` bidirectional stream
`proj-stream-events`	`ProjectionService/StreamProjectionEvents` server stream
`proj-catchup`	`ProjectionService/WaitProjectionCatchupStream` server stream
`pubsub-subscribe`	`PubSubService/Subscribe` server stream and `GET /ws`
`pubsub-subscribe-bidi`	`PubSubService/SubscribeBidirectional` bidirectional stream (consumer groups)
`pubsub-cg-join`	`PubSubService/JoinConsumerGroup` server stream
`kv-watch`	`GET /api/v1/kv/buckets/{bucket}/watch` WebSocket upgrade
`config-watch`	`GET /api/v1/config/{name}/watch` WebSocket upgrade

The KV and config watch routes are present in sdk-parity.yaml and measured in sdk-coverage.json. The generic GET /ws transport is deliberately skipped by the endpoint ledger and represented by the pubsub-subscribe capability row.

Events & Triggering

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
event-emit	Emit/trigger event	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
event-emit-sync	Synchronous trigger	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
event-emit-batch	Batch trigger	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
event-list	List events	no	API key/JWT	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
event-names	List event names	no	API key/JWT	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
event-get	Get event by ID	no	API key/JWT	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
event-explain-match	Explain current event routing	no	API key/JWT; CLI and MCP and dashboard	not-applicable	full	not-applicable	missing	missing	missing	full	not-applicable	tested	documented	known gap	Evolving

Functions & Registration

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
function-register	Register function	yes	API key	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
function-list	List functions	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
function-get	Get function detail	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
function-invoke	Direct invoke by ID	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
function-invoke-async	Direct invoke by ID without waiting	no	API key/JWT	not-applicable	full	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
function-status	Enable/disable function	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
function-delete	Delete function	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
function-history	Function version history	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
function-at-version	Get function at version	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
function-rollback	Rollback function version	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
deployment-register	Register executable deployment	no	API key/JWT; functions:register	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
deployment-read	Read deployments and execution routing	no	API key/JWT; functions:read	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready

Runs & Lifecycle Control

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
run-list	List runs	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
run-get	Get run	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
run-steps	Run step list	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
run-cancel	Cancel run	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
run-delete	Delete terminal runs	no	API key/JWT; runs:delete (admin)	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
payload-redact	Redact stored payloads	no	API key/JWT; events:redact (admin)	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
run-resume	Resume run	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
run-pause	Pause run	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
run-paused-state	Get paused-run state	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
run-audit	Per-run audit trail	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
run-streams	Entity streams touched by run	no	API key/JWT	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

Scoped Injection & History Editing

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
step-patch	Live patching of step output	no	none	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
step-inject-output	Inject step output into paused run	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

Time-Travel Debugging

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
tt-run-state-at	Run state at timestamp	no	RPC-only	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
tt-run-timeline	Run mutation timeline	no	RPC-only	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
tt-step-output-at	Historical step output	no	RPC-only	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

Durable Step Primitives

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
step-run-memoized	step.run memoization	yes	Tier-1 SDKs only (Go, Node, Python)	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
step-sleep	Durable sleep/sleepUntil	yes	Tier-1 SDKs only (Go, Node, Python)	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
step-wait-for-event	waitForEvent yield	yes	Tier-1 SDKs only (Go, Node, Python)	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
step-invoke	step.invoke / invokeAsync	yes	Tier-1 SDKs only; ADR 0010	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
step-parallel	Parallel branches	yes	Tier-1 SDKs only; client-side execution	not-applicable	not-applicable	indirect	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
step-compensate	Saga compensation	yes	Tier-1 SDKs only (Go, Node, Python)	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready

Execution Modes

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
exec-push-serve	Push mode serve()	yes	PushTimeout budget; optional HMAC signature	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
exec-pull-worker	Pull worker protocol (register/heartbeat/poll/ack/update)	yes	REST routes always mount; engine required for dispatch; parity-manifest excluded	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
exec-workers-list	List connected workers	no	API key/JWT	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
exec-streaming-worker	Streaming worker (bidi)	yes	opt-in; Connect service mounts only when the engine has a worker manager	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
sdk-trace-continuation-node	JavaScript job trace continuation	yes	Node only; optional @opentelemetry/api peer; application configures tracing	not-applicable	not-applicable	full	not-applicable	full	not-applicable	not-applicable	not-applicable	tested	documented	none	Evolving
sdk-python-execution-tracing	Python execution trace continuation	yes	Optional tracing extra; application configures OTel provider	not-applicable	not-applicable	full	not-applicable	not-applicable	not-applicable	full	not-applicable	tested	documented	intentional product boundary	Ready
sdk-python-correlated-logging	Python callback log correlation	yes	Python only; native logging; application-owned optional OTel LoggingHandler; no engine log collection	not-applicable	not-applicable	full	not-applicable	not-applicable	not-applicable	full	not-applicable	tested	documented	intentional product boundary	Evolving
sdk-correlated-logging-node	JavaScript correlated application logging	yes	Node only; app-owned native or explicit OTel Logs sink; no Ironflow collection	not-applicable	not-applicable	full	not-applicable	full	not-applicable	not-applicable	not-applicable	tested	documented	intentional product boundary	Evolving

Entity Streams & Snapshots

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
stream-append	Append entity event	no	optimistic concurrency	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
stream-read	Read stream events	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
stream-info	Stream info	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
stream-list	List entity streams	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
stream-history	Unified entity history	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
snapshot-create	Create snapshot	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
snapshot-get	Get snapshot	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
stream-delete	Delete entity stream	no	API key/JWT; streams:delete (admin)	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready

Projections

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
proj-register	Register projection (external runner)	yes	worker-SDK surface	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
proj-unregister	Unregister projection	yes	worker-SDK surface	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
proj-runner-transport	Runner transport (poll/save-state/ack)	yes	RPC_SKIP transport plumbing	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
proj-runner-lease	Runner lease (acquire/renew/release)	yes	RPC_SKIP transport plumbing	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
proj-stream-events	Stream projection events	yes	server-stream	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
proj-get	Get projection	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
proj-list	List projections	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
proj-status	Projection status/lag	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
proj-partitions	Partition listing	no	API key/JWT; browser operator boundary	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-rebuild	Rebuild projection	no	API key/JWT; browser operator boundary	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-rebuild-status	Rebuild job status	no	API key/JWT; browser operator boundary	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-rebuild-cancel	Cancel rebuild	no	API key/JWT; browser operator boundary	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-pause	Pause projection	no	API key/JWT; browser operator boundary	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-resume	Resume projection	no	API key/JWT; browser operator boundary	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-delete	Delete projection	no	API key/JWT; browser operator boundary	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-sql-create	Create managed SQL projection	no	Go uses raw SQL; browser operator boundary	not-applicable	full	not-applicable	intentionally-excluded	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-sql-query	Query SQL projection	no	API key/JWT	not-applicable	full	not-applicable	intentionally-excluded	full	full	full	not-applicable	tested	documented	none	Ready
proj-catchup	Wait for projection catchup	no	#473; stream variant exists	not-applicable	full	full	full	full	full	full	not-applicable	tested	documented	none	Ready
proj-catchup-batch	Batch catchup wait	no	API key/JWT; browser operator boundary	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
proj-wait-for-event	Wait for event applied	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
worker-projection-managed	Managed (pure reducer) projection handler	yes	Tier-1 SDKs only (Go, Node, Python)	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
worker-projection-external	External (side-effect) projection handler	yes	Tier-1 SDKs only (Go, Node, Python)	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
event-upcasters	Client-side upcaster registry	yes	runtime registration Tier-1 only (Go/Node/Python workers); Browser has no worker runtime; server dry-run separate	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
proj-history	List definition history	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
proj-revision	Get archived definition	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

Pub/Sub

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
pubsub-publish	Publish to topic	no	NATS required; REST and Connect return 503 without a bridge	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
pubsub-subscribe	Subscribe replay+live	no	NATS required; Connect service is late-mounted; WebSocket subscribe errors without a manager	not-applicable	full	full	full	full	full	full	not-applicable	tested	documented	none	Ready
run-event-version	Run frame version (drop a stale status)	no	Run and step frames carry committed row versions and rank independently by full identity; lower positive versions drop and ties or unknown versions pass; deletion blocks late run and step frames including unknown versions while remembered in the shared bounded cache; filters are opt-in except browser agents.subscribe and CLI subscribe	not-applicable	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Evolving
pubsub-subscribe-bidi	Bidirectional subscribe	no	Consumer groups only; API key/JWT events:subscribe; No Python client yet; Python composes join_consumer_group and ack_event. Browser cannot stream both ways	not-applicable	full	not-applicable	full	full	intentionally-excluded	indirect	not-applicable	tested	documented	SDK transport gap	Evolving
pubsub-cg-manage	Consumer group CRUD	no	NATS required; Connect service is late-mounted	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
pubsub-cg-join	Join consumer group	no	NATS required; Connect service is late-mounted	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
pubsub-cg-ack	Acknowledge consumer group event	no	NATS required; MANUAL consumer groups only	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
pubsub-topics	List topics	no	NATS required; Connect service is late-mounted; browser operator boundary	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
pubsub-topic-stats	Topic stats	no	NATS required; Connect service is late-mounted; browser operator boundary	not-applicable	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready

KV Storage

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
kv-buckets	KV bucket CRUD	no	NATS required; REST routes are absent without a provider	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
kv-keys	KV key CRUD + list	no	NATS required; REST routes absent without a provider; Python exposes conditional headers as generated kwargs	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
kv-watch	Watch KV bucket	no	NATS required; REST watch route is absent without a provider	full	not-applicable	full	full	full	full	full	not-applicable	tested	documented	none	Ready

Configuration

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
config-read	Get/list config	no	NATS required; REST routes are absent without a provider	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
config-write	Set/patch/delete config	no	NATS required; REST routes are absent without a provider; server-only	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
config-watch	Watch config	no	NATS required; REST watch route is absent without a provider; browser uses a WebSocket topic instead	full	not-applicable	full	full	full	indirect	full	not-applicable	tested	documented	none	Ready

Secrets

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
secret-crud	Secrets CRUD (values write-only)	no	Secrets manager required; REST routes are absent without one; browser-excluded by design	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready

Event Schemas

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
schema-register	Register schema version	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
schema-read	List/get schemas	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
schema-check-enforcement	Check schema enforcement	no	API key/JWT; Python RPC facade and the CLI only	not-applicable	full	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
schema-delete	Delete schema version	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
schema-test-upcast	Dry-run upcaster chain	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
schema-history	List definition history	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
schema-revision	Get archived definition	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

Webhooks

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
webhook-ingest	Inbound provider webhook	no	ifwh_ token waiver (ADR 0048); not SDK-callable	full	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	tested	documented	intentional product boundary	Ready
webhook-source-crud	Webhook source management	no	snake_case codec (ADR 0023)	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
webhook-secret-ops	Rotate/expire secrets + ingest token	no	returns minted secrets to caller incl. browser	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
webhook-verify-test	Test verification config	no	request carries signing secret; dashboard diagnostic	not-applicable	full	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
webhook-deliveries	Delivery log	no	API key/JWT	not-applicable	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

Agents & Tools

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
agent-tool-register	Register agent tool	yes	URL guard on callbacks	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
agent-tool-invoke	Invoke agent tool	yes	server-driven HMAC dispatch	not-applicable	full	not-applicable	indirect	indirect	not-applicable	full	not-applicable	tested	documented	none	Ready
agent-tool-unregister	Unregister agent tool	yes	worker-SDK surface	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
agent-tool-list	List agent tools	no	API key/JWT	not-applicable	full	not-applicable	full	full	not-applicable	full	not-applicable	tested	documented	none	Ready
agent-authoring	Agent authoring runtime (agent/defineTool/exposeMcp/llm/memory/spawn/approve)	yes	Tier-1 SDKs only	not-applicable	not-applicable	full	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
agent-client-invoke	Invoke agent + read memory (client composition)	no	InvokeFunctionSync for invoke; projection composition for readMemory	indirect	indirect	not-applicable	indirect	indirect	full	indirect	not-applicable	tested	documented	none	Ready

Adapters

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
langgraph-checkpointer	LangGraph checkpointer (IronflowSaver)	no	checkpointer-only product scope; list() without thread_id throws	indirect	indirect	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	full	tested	documented	none	Ready

Browser-Only Capabilities

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
browser-offline-queue	Offline write queue (IndexedDB + multitab lock)	no	ADR 0053; browser-only	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	full	not-applicable	not-applicable	tested	documented	none	Ready

Operational Controls

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
circuit-breaker-manage	Circuit breakers list/reset	no	CLI ironflow circuit-breaker is the supported route; ADR 0037	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
capacity-views	Capacity observability	no	read-only ops surface	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
debounce-manage	Debounce list/cancel	no	ops surface	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
dead-letter-list	Stored dead-letter row listing	no	events:subscribe and explicit environment; REST CLI and MCP only	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	intentionally-excluded	not-applicable	tested	documented	intentional product boundary	Ready
outbox-dlq	Outbox DLQ list/requeue/discard	no	CLI ironflow outbox dlq is the supported route	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
flow-edges	Flow map edges (emit/stream/topic/invoke/wait/webhook)	no	dashboard surface (#1262)	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
sql-execute	Raw SQL query	no	API key/JWT	not-applicable	full	not-applicable	full	intentionally-excluded	full	full	not-applicable	tested	documented	none	Ready
audit-env-wide	Environment-wide audit	no	runs:read RBAC	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
audit-settings-read	Audit settings view	no	runs:read RBAC; operator view of the effective audit policy	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
audit-export	Filtered Audit Log JSONL export	no	runs:read RBAC; dashboard download and direct HTTP stream	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	intentionally-excluded	not-applicable	tested	documented	intentional product boundary	Ready
auth-audit	Authentication and authorization audit	no	runs:read RBAC; generated Python only	not-applicable	full	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready

Projects & Environments

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
project-crud	Project CRUD	no	server-side surface	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
env-crud	Environment CRUD	no	EnvironmentService mounted; hand-written SDK methods remain REST-backed per ADR 0065	full	full	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	none	Ready
env-rotate-apikey	Rotate environment API key	no	rotates by key id over REST (apikey-rotate’s route); compatibility RPC rejects ambiguous multi-key admin rotation	indirect	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

API Keys

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
apikey-crud	API key CRUD	no	ifkey_/ifplatform_ prefixes	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
apikey-rotate	Rotate API key	no	minted secret returned to caller	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
apikey-roles	Replace key roles	no	admin RBAC; generated Python only	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready

Organizations

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
org-crud	Organization CRUD	no	RBAC + IsPlatform; SDK create calls POST /api/v1/platform/orgs; tenant POST /orgs returns 403	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
org-export	NDJSON customer-data export	no	authenticated administrators; no SDK wrapper; per-node single-flight (#774)	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	intentionally-excluded	not-applicable	tested	documented	intentional product boundary	Ready

Roles & Policies

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
role-crud	Role CRUD	no	admin RBAC	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
policy-set	Rego policy set (get, put, validate, dry-run, versions, rollback)	no	enterprise-only; admin RBAC; PUT and rollback need If-Match	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

Users

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
user-crud	User CRUD	no	server-only	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
user-password	Change user password	no	self-only session route (users:password: every built-in role); server-only browser boundary	full	not-applicable	not-applicable	full	full	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready

Tenants

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
tenant-provision	Provision tenant	no	bootstrap-org admin (instance-scoped)	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
tenant-list	List tenants	no	bootstrap-org admin (instance-scoped)	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready

Platform Control Plane

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
platform-auth	Platform login + bootstrap	no	login public; bootstrap needs tenant admin key	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
platform-admin	Platform users/roles/tenants/audit	no	RequirePlatform(); ifplatform_ key	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
platform-policy-set	Platform Rego policy set (get, put, validate, dry-run, versions, rollback, break-glass monitor)	no	enterprise-only; RequirePlatform(); ifplatform_ key; PUT and rollback need If-Match	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
instance-admin	Instance barrier and conservative drain administration	no	platform actions	full	full	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Experimental

Auth & Sessions

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
auth-dashboard-session	Dashboard login/validate/desktop-session	no	excluded from SDK parity by design	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	intentionally-excluded	not-applicable	tested	documented	intentional product boundary	Ready

Cluster & Infrastructure

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
cluster-ops	Cluster health + rotate-token	no	meta control plane; not tenant-callable	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
health-ready	Liveness/readiness	no	public paths	full	full	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
metrics-endpoint	Prometheus metrics	no	conditional on metrics enabled	full	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	tested	documented	none	Ready
capabilities-discovery	Server capability discovery	no	public; SDK transport detection	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready
openapi-spec	OpenAPI 3.1 spec	no	REST-only contract; WS surfaces absent from artifact	full	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	tested	documented	none	Ready
server-introspection	Overview/routes/debug/SPA/pprof	no	parity-excluded tooling surfaces	full	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	tested	documented	none	Ready
server-info	Server info	no	CLI `ironflow server info`; RPC_SKIP transport metadata; no SDK wrapper	not-applicable	full	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	not-applicable	tested	documented	intentional product boundary	Ready
cluster-log-level	Temporary cluster log level	no	instance admin; explicit shared JWT in multi-node mode	full	not-applicable	not-applicable	intentionally-excluded	intentionally-excluded	intentionally-excluded	full	not-applicable	tested	documented	intentional product boundary	Ready
go-sdk-trace-continuation	Go SDK W3C trace continuation	yes	Application-configured OTel provider; Go only (#3438)	not-applicable	not-applicable	not-applicable	full	not-applicable	not-applicable	not-applicable	not-applicable	tested	documented	none	Evolving
go-sdk-correlated-logging	Go SDK correlated function logging	yes	Application-owned slog handler and optional OTel Logs bridge; Go only (#3444)	not-applicable	not-applicable	not-applicable	full	not-applicable	not-applicable	not-applicable	not-applicable	tested	documented	none	Evolving

Files

ID	Capability	Worker	Restrictions	REST	ConnectRPC	Other	Go	Node	Browser	Python	LangGraph	Tests	Docs	Classification	Readiness
files-storage	File storage: buckets, files, signed URLs	no	Blob backend required (always present; filesystem by default); signed routes are public, token is the credential	full	not-applicable	not-applicable	full	full	full	full	not-applicable	tested	documented	none	Ready